CVE-2025-66434

A Server-Side Template Injection (SSTI) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through version 15.89.0 . The issue stems from the function rendering attacker-controlled Jinja2 templates (body_text) using frappe.render_template() with a user-supplied context. ...

CVE-2025-66434: Improper Control of Generation of Code

An SSTI Server-Side Template Injection vulnerability exists in the getdunninglettertext method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates bodytext using frappe.rendertemplate with a user-supplied context doc. Although Frappe uses a custom...

CVE-2025-66434

An SSTI Server-Side Template Injection vulnerability exists in the getdunninglettertext method of Frappe ERPNext through 15.89.0. The function renders attacker-controlled Jinja2 templates bodytext using frappe.rendertemplate with a user-supplied context doc. Although Frappe uses a custom...